d15e0afafc2ecbbc3883d3a1369542c16dfc3ed395e13e9de233fadaeb003f4c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
catlean_1.21.11.jar
Size 10.6MB
Sample260522-rdz4jsds7j
SHA256 d15e0afafc2ecbbc3883d3a1369542c16dfc3ed395e13e9de233fadaeb003f4c
MD5 c15af2839acb31f2fac2ee177c01c545
SHA1 a34ee078867ff2a94ada33477c0eeb94ac855de1
SHA512 f95f4dd908bd04725ee593be4b496bf56237c17cffe608bfd67d2c7cfabb280c905a661f600bf1c5198c17fe8946f29d801dd9a36bc953ecb9228c60e510174c
SSDEEP 196608:U5/L57DWES67iJ6Uvn5pG15WyQ1QpGwFuwG6DXcMVLAzWWs7pru3ge4Wuzfhxpjr:2L5+m7dUWz0a7uwG6rcMVyWdpdBzfhxx
TLSH
T195B6125A3FE48565DE07A0B20900F5636C2A53CDD106A02BC9B40DDB5B77DAA8F13EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	chrome.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
7404	chrome.exe
7404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe
Token: SeShutdownPrivilege	952	chrome.exe
Token: SeCreatePagefilePrivilege	952	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe
2444	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2444	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4780	952	chrome.exe	106
PID 952 wrote to memory of 2652	952	chrome.exe	107
PID 952 wrote to memory of 2780	952	chrome.exe	108
PID 952 wrote to memory of 2908	952	chrome.exe	109
PID 952 wrote to memory of 2780	952	chrome.exe	108
PID 952 wrote to memory of 2908	952	chrome.exe	109
PID 952 wrote to memory of 4044	952	chrome.exe	111
PID 952 wrote to memory of 1900	952	chrome.exe	112
PID 952 wrote to memory of 4044	952	chrome.exe	111
PID 952 wrote to memory of 1900	952	chrome.exe	112
PID 952 wrote to memory of 4544	952	chrome.exe	113
PID 952 wrote to memory of 4544	952	chrome.exe	113
PID 952 wrote to memory of 1600	952	chrome.exe	115
PID 952 wrote to memory of 1600	952	chrome.exe	115
PID 1856 wrote to memory of 2444	1856	firefox.exe	117
PID 1856 wrote to memory of 2444	1856	firefox.exe	117
PID 2444 wrote to memory of 3220	2444	firefox.exe	118
PID 2444 wrote to memory of 3220	2444	firefox.exe	118
PID 2444 wrote to memory of 3220	2444	firefox.exe	118
PID 2444 wrote to memory of 5136	2444	firefox.exe	119
PID 2444 wrote to memory of 5136	2444	firefox.exe	119
PID 2444 wrote to memory of 5136	2444	firefox.exe	119
PID 2444 wrote to memory of 5136	2444	firefox.exe	119
PID 2444 wrote to memory of 5520	2444	firefox.exe	122
PID 2444 wrote to memory of 5520	2444	firefox.exe	122
PID 2444 wrote to memory of 5520	2444	firefox.exe	122
PID 2444 wrote to memory of 5520	2444	firefox.exe	122
PID 2444 wrote to memory of 5548	2444	firefox.exe	123
PID 2444 wrote to memory of 5548	2444	firefox.exe	123
PID 2444 wrote to memory of 5548	2444	firefox.exe	123
PID 2444 wrote to memory of 5764	2444	firefox.exe	124
PID 2444 wrote to memory of 5764	2444	firefox.exe	124
PID 2444 wrote to memory of 5764	2444	firefox.exe	124
PID 2444 wrote to memory of 5764	2444	firefox.exe	124
PID 2444 wrote to memory of 6984	2444	firefox.exe	125
PID 2444 wrote to memory of 6984	2444	firefox.exe	125
PID 2444 wrote to memory of 6984	2444	firefox.exe	125
PID 2444 wrote to memory of 6984	2444	firefox.exe	125
PID 2444 wrote to memory of 7008	2444	firefox.exe	126
PID 2444 wrote to memory of 7008	2444	firefox.exe	126
PID 2444 wrote to memory of 7008	2444	firefox.exe	126
PID 2444 wrote to memory of 7008	2444	firefox.exe	126
PID 2444 wrote to memory of 7024	2444	firefox.exe	127
PID 2444 wrote to memory of 7024	2444	firefox.exe	127
PID 2444 wrote to memory of 7024	2444	firefox.exe	127
PID 2444 wrote to memory of 7024	2444	firefox.exe	127
PID 2444 wrote to memory of 7032	2444	firefox.exe	128
PID 2444 wrote to memory of 7032	2444	firefox.exe	128
PID 2444 wrote to memory of 7032	2444	firefox.exe	128
PID 2444 wrote to memory of 7032	2444	firefox.exe	128
PID 2444 wrote to memory of 7048	2444	firefox.exe	129
PID 2444 wrote to memory of 7048	2444	firefox.exe	129
PID 2444 wrote to memory of 7048	2444	firefox.exe	129
PID 2444 wrote to memory of 7048	2444	firefox.exe	129
PID 2444 wrote to memory of 7124	2444	firefox.exe	130
PID 2444 wrote to memory of 7124	2444	firefox.exe	130
PID 2444 wrote to memory of 7124	2444	firefox.exe	130
PID 2444 wrote to memory of 7124	2444	firefox.exe	130
PID 2444 wrote to memory of 7152	2444	firefox.exe	131
PID 2444 wrote to memory of 7152	2444	firefox.exe	131
PID 2444 wrote to memory of 7152	2444	firefox.exe	131
PID 2444 wrote to memory of 7152	2444	firefox.exe	131
PID 2444 wrote to memory of 5964	2444	firefox.exe	132
PID 2444 wrote to memory of 5964	2444	firefox.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\catlean_1.21.11.jar
1⤵
PID:2980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x9c,0x124,0x7ffcf39dc728,0x7ffcf39dc734,0x7ffcf39dc740
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,13313116250278173084,14942456546907648785,524288 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,3542335341761829345,5657922277667779811,524288 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,8509163333245972594,2601338545103703261,262144 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,3547456906493640283,13858811925542271387,2097152 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,18191567839133750671,5686827172353434875,2097152 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,3380603912722429820,10785187854805101350,2097152 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,5851258398529250091,1412888498179848374,2097152 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,5944946470775791122,5609774793885180355,524288 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5466562613673691335,17297757242166585981,524288 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:6336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,7888170242222141227,8270723776204794735,524288 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4476,i,1308415763891938209,813439478455218143,262144 --field-trial-handle=2116,i,8284175081922784674,3746053326634528136,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {66f1124d-027b-40e7-8f5b-7a4f7da8b669} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {0d1a3e45-9bb6-49a1-a6a0-fa53813a17ac} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27276 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {f9b5b493-f218-4fee-84c8-8db17c83690f} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27276 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {5eea2469-bca1-4fec-b297-7fb8c0530ba0} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1624 -prefsLen 34775 -prefMapHandle 1628 -prefMapSize 270279 -jsInitHandle 2948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4368 -initialChannelId {77239e49-f564-4833-a160-1314af91dcbb} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4020 -prefsLen 35012 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 2952 -initialChannelId {3140d0d9-21e6-40da-a869-be5c4a9a7923} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4872 -prefsLen 32900 -prefMapHandle 4876 -prefMapSize 270279 -jsInitHandle 4880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3060 -initialChannelId {9176e6cf-daf0-4a4f-a1c3-cc06219eccba} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:7008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32900 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {bd69c74a-7d9d-440c-a276-b35f8f4b9242} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:7024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {17374b68-39b7-4a47-8adc-3102c07154b7} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:7032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5136 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5168 -initialChannelId {1cc4f78a-f2d0-4976-b785-3788a276b58f} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:7048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5552 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5612 -initialChannelId {6de5d03d-244c-4ee2-a160-22243ba2d1ee} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:7124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {6febdd64-16a9-4081-8429-31e140bd03f1} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:7152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {f95c32d9-ed97-4fd1-aeba-6b612000a0fd} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6020 -prefsLen 32952 -prefMapHandle 6024 -prefMapSize 270279 -jsInitHandle 6028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6036 -initialChannelId {ae913d0b-24c0-4d04-ac21-c7d53f59d99f} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6052 -prefsLen 32952 -prefMapHandle 6056 -prefMapSize 270279 -jsInitHandle 6060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {2d16558c-d7aa-4718-ac81-485c9d0b7945} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6084 -prefsLen 32952 -prefMapHandle 6088 -prefMapSize 270279 -jsInitHandle 6092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {7c00f868-8394-4ae9-8374-dc398e3c1e90} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6612 -prefsLen 32952 -prefMapHandle 6616 -prefMapSize 270279 -jsInitHandle 6620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3312 -initialChannelId {1cc3db95-e34d-4236-9d35-ec0f8c5c91fc} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:6068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6632 -prefsLen 32952 -prefMapHandle 6636 -prefMapSize 270279 -jsInitHandle 6640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6648 -initialChannelId {de9878af-7484-44f9-b641-5ee069fd88f1} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6664 -prefsLen 32952 -prefMapHandle 6668 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6680 -initialChannelId {74911ddf-b8e9-4801-bab4-32b8eb786190} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7160 -prefsLen 32952 -prefMapHandle 7164 -prefMapSize 270279 -jsInitHandle 7172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7228 -initialChannelId {21a6e554-8da8-4990-bad7-408c07fefb02} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:6100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7188 -prefsLen 32952 -prefMapHandle 7192 -prefMapSize 270279 -jsInitHandle 7196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7236 -initialChannelId {a26f1e2b-b515-4daf-9707-ab108dc2401c} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
    3⤵
    - Checks processor information in registry
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7212 -prefsLen 32952 -prefMapHandle 7216 -prefMapSize 270279 -jsInitHandle 7220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7244 -initialChannelId {d005bdc0-f42c-4209-9417-b443acc65548} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
    3⤵
    - Checks processor information in registry
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7728 -prefsLen 32952 -prefMapHandle 7732 -prefMapSize 270279 -jsInitHandle 7736 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7792 -initialChannelId {1f195c1a-ea76-4f3c-9f0e-b0b7faee7466} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
    3⤵
    - Checks processor information in registry
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7752 -prefsLen 32952 -prefMapHandle 7756 -prefMapSize 270279 -jsInitHandle 7760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7800 -initialChannelId {1c2c82d5-2011-422d-9cca-5411ee72d3ef} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
    3⤵
    - Checks processor information in registry
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7776 -prefsLen 32952 -prefMapHandle 7780 -prefMapSize 270279 -jsInitHandle 7784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7808 -initialChannelId {370e7961-a019-4b33-9d39-bab02fab9cc1} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
    3⤵
    - Checks processor information in registry
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8296 -prefsLen 32952 -prefMapHandle 8300 -prefMapSize 270279 -jsInitHandle 8304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8360 -initialChannelId {031b33e7-ffa9-40a3-a0b7-61a7fa88bca5} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
    3⤵
    - Checks processor information in registry
    PID:4788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8320 -prefsLen 32952 -prefMapHandle 8324 -prefMapSize 270279 -jsInitHandle 8328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8368 -initialChannelId {1cb63860-b98b-4ce0-81d6-f1cd089c443f} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
    3⤵
    - Checks processor information in registry
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8344 -prefsLen 32952 -prefMapHandle 8348 -prefMapSize 270279 -jsInitHandle 8352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8376 -initialChannelId {6f3033dd-7854-4fff-a0f6-ba3a28f19913} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
    3⤵
    - Checks processor information in registry
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8352 -prefsLen 32952 -prefMapHandle 8348 -prefMapSize 270279 -jsInitHandle 8344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8896 -initialChannelId {1fef19a5-22dd-42d2-9e80-0cc65533ad67} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
    3⤵
    - Checks processor information in registry
    PID:5292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8912 -prefsLen 32952 -prefMapHandle 8916 -prefMapSize 270279 -jsInitHandle 8920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8952 -initialChannelId {d1ed6094-df31-496d-98f0-3ced00807001} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
    3⤵
    - Checks processor information in registry
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8936 -prefsLen 32952 -prefMapHandle 8940 -prefMapSize 270279 -jsInitHandle 8944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8960 -initialChannelId {59ff55da-7b65-4b9e-8b10-93596a8facdb} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9428 -prefsLen 32952 -prefMapHandle 9432 -prefMapSize 270279 -jsInitHandle 9436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9492 -initialChannelId {fa7ace94-e5b9-4506-9270-dba4bbbe2052} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
    3⤵
    - Checks processor information in registry
    PID:5372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9452 -prefsLen 32952 -prefMapHandle 9456 -prefMapSize 270279 -jsInitHandle 9460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9500 -initialChannelId {9c4c3570-a06f-400c-a0fa-e4650ce19c14} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
    3⤵
    - Checks processor information in registry
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9476 -prefsLen 32952 -prefMapHandle 9480 -prefMapSize 270279 -jsInitHandle 9484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9508 -initialChannelId {a0440011-5de9-44a6-b905-26251f5be871} -parentPid 2444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
    3⤵
    - Checks processor information in registry
    PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8bdd03c1a08a93ea6f0eaff68c3bf657f8f1f98f619673c01bd29cedfe832dda
MD5 e063a95ec312e3a3d2282d5e9b430368
SHA1 25c023dbc81bfab0c5ebdeae451aae2df7269cbf
SHA512 01736e8d893496d6eb710c320620a77407fe5e8fb97e8b7751cba52b6fab7b6b5ed750b5ce1c513c1f16ad1cf99d1122269ec2b1538e95af6833b539d405bf20
TLSH
T15D516CF7D7D8866DC85156F4AB216E1FCD2E0A28531C3C56C8D4AF4B57E68B2D20024E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 63a9d3b488877469a8c13b1917dd9d50f3998261ecf1f18368ab619080e613c8
MD5 398791c7d727e0050d90a590b83ac509
SHA1 d3c0b05d874d875cb06c1114701d921dabbd6be4
SHA512 78de4846ea756ab40982e7b346fbaa220f10830b12a57b2155f593e93678d4a72a6be5fdae310b90e9dfe41efb571080c39d7eb8d71bb5bd5baf302816b39ffa
SSDEEP 192:7RcuxFcWpg8NoHv7ApAPRp2l9qHsb+WNnzs0uMe52ShVyIsnAUge:7RcuL/OPkUXmkwo0M2Ce
TLSH
T1CD42B72EEE10693BACDBC21AFA653767D7F5103521D42E84EAFC8A2C25D75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b9c3bcc222d8c0905dae5c7f7335a8e9b938b4322f968e9775deb44288c84180
MD5 10e19ca408c5ed5d1564172866ee034a
SHA1 39bb9e07557ec0c478f5ff7f1c80c4d9a622335c
SHA512 1e40f8f5c50efc36672bdf812162603157fbe8f20bd4f841b61e50a8a89366a0ddf3f04015a032b31c46166be1ae173e871d454f7c271be4700906b51c11f489
TLSH
T116B01240C0026195C48282B0124B1CCC72645F209A0A370543E06926C8351728014060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d675.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d675.TMP
Size 96B
SHA256 f992cdc6efbcff7654ca9be032c28425984a1cc817b9dfd51563a65e89d1a3dc
MD5 a32e791b31d68e1428b0ff6f2da03740
SHA1 ae673eb433490c4e1610fb0225f8b053cdfa8667
SHA512 05ef01b9ec2f50f1969015c451698b4134afbd9d7ad56d0ca7b0390ef4cd4a1bf004bcff43b20286cf70ce028a484f60845db97956c51c640633e0afb22be5cb
TLSH
T1D1B00295C643F216C09247F4A5A995D872A0DF29CA03131693E01B7BDC2AA714526560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b0b88bb22926854aff05f2b54c1c3d9d84d64f79921babcb1f843db703633e4f
MD5 9f23841ddfe8053889d508b16c90ac1d
SHA1 45d81fa180a17300053377e9b32438da9ffed4ef
SHA512 83fad3410159742f87ddaa62d61c6811b5072cb541378414c55d962fa0f9f74ca85f1af5d7abcde1ca4e3595a8f8167ed24011a207cf4395991811b15ee74dd0
SSDEEP 3072:5qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:fm7Rkm1tYpBeh2BAoB
TLSH
T1AAC3023B5E74E8375DB5A75EA08E0B1F1EF249A7C920DE9288D85B0433E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 027d2bf89f7e7b703d268b5725f8238f3fd4c5803ea82b2330c9c18a5bc3ff96
MD5 f53be7107470857f873d86b1226afeac
SHA1 c3afc2b5f08664d5e073283661a3cde540507443
SHA512 326d884c17732d8f1bd66e4a16a9ace54cfaf71727e6ed9424a0dfd6bd31e97786de1b11eae0489dcd09752df54b3d9c2104983c249fe76a7a043c581f7750ef
SSDEEP 3072:eqGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:Km7Rkm1tYpBeh2BAoB
TLSH
T1C2C3123B5E74E8375DB5A75EB04E0A2F1EF249A7C920DE9288D85B0433E97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e07cf7d80a32631caf646f76f4775fb38d7eae928c0ae4edc78ac18e3b2c2738
MD5 4d7b845cf3ec47f96a4dc40a49468bd8
SHA1 4ff125c392737acb1d840856cae055ea30d5e65a
SHA512 9db78f29b523cb294ae58e5beb03162b8b27191734d1a824e300a11368ce9c3d99eaf93a004a02a6428312c2647e8a6747f2092ed5ba295cc480a112c2f7a827
SSDEEP 3072:A/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:tm7Rkm1tYpBeh2BAog
TLSH
T1B6C3023B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3ac5616dc3ba05609a8b4732baa4553f63a8acaa2e2613e4bf31bc8a7099064e
MD5 66f8ac7c8b164ebd38c7d922a185a45e
SHA1 1ba16996b9cb08bf27f42ecfde2a3d3d39c9185d
SHA512 3b7e9416b3ff2a4a45704f6509fb98e55334082eaf811ddec560281534cf4e565346c6897a7d226ffc62c9a9ea9c9f5553fb1eb278a8a1b979df7697ed839c0e
SSDEEP 3072:exGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:xm7Rkm1tYpBeh2BAoB
TLSH
T159C3123B5D74E8375CB5A70EB04E0A2F1EF149A6C924DE92C8D85B0437F97CD0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 105ece551367abaadb0d61d4e97c11535234ab59677f327933ef19f1c1e173e6
MD5 dec4355f111a8514bf8d52d378a0b2f3
SHA1 0e86cfa6eb3c6b1e8a52b271fabc0e4d1019623a
SHA512 c01cb2380503420da5ba19b63cfecf987671923b0a2751985b15c4341531ce38194834600321ef0e38048a8e98faf4adba0c0d687b8465edd7f659f6fad828d0
TLSH
T16561B959F62A863FE848413ADC821B415F307456A8AF3F2A35ACA04D1E5B2CD76CD03E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 dd6f44216b7649c1a8b89fbace6c9a35a8e15221a500c5e197a490540084b73b
MD5 f558c89bd73f65897713f2d5ede9dde8
SHA1 db8ab016c415f7b846f11652502323666dd4a803
SHA512 218ce2d4a7926be14e9f3d4928827388828355d27038da1963c89ff95879f88abf01708bcc90b4416b3583909abb2d0d881c54f9351da91ed088689af020cd0e
SSDEEP 192:6POv5zboPbMqmyjFyxgzeii1d66JozGzgCl6mc0dz:6gbooqmyjcFd66JozGzgC1jd
TLSH
T1CBE11FA4EA29863BC408027BCDA61F814F39395AD84E3F2931DD745C2D572DE368E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 974fc2e109383a49a78c89d86102440194578fbf25345fd1fa184f5efc87f637
MD5 6aa75eb77ddac88fb267d99af239a558
SHA1 d499127fe617d58782e92bec4a6c3db4f9a2c433
SHA512 c2eefb51940e82d2cb72f3a983b6762ccb5a166b26d31a25e2bfe074ff83a648021caef14e456d2d4f66eec48939cc7b17c0d8e96b3c71957f2e249f8a35e405
SSDEEP 192:CPOv5zbowbqmyjFyMgaeii1d66JozGzgCl6mc0d:CgbowbqmyjDCd66JozGzgC1j
TLSH
T179D11EA4EA28463BC408133BCDA61F810F35395BD84E3F2A31DD745C2D5A29E768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6d6844381fec69a6cb1f455ca2e8be144428b0f0675da4c97f5e1a0c1c17a7eb
MD5 02404d0d9943be09a6e8bd78d675f59d
SHA1 4c48d3bb770cdec8a271821eb1b16fbc554f5f81
SHA512 c5661ee5cf865bdff0e27bc6f4b492626d5707dee5cad309e1b98a3cf8f8e9e8a2b193c7f29e3a7f29253260984acd3a0a23b512c79295432db6fdce606cc8c4
SSDEEP 192:RPOv5zboPb6ZqmyjFyxgaeii1d66JozGzgCl6mc0dz:RgboOZqmyjcCd66JozGzgC1jd
TLSH
T1CEE11FA8EA29863BC408037BCDA61F910F35395AD84E3F29359D741C2D572DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d1f306f-7c94-42dc-8800-d6ebcbf9a490

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\0d1f306f-7c94-42dc-8800-d6ebcbf9a490
Size 883B
SHA256 308c13d5fbbb976e8b081ab55bdcaf5d5dac34e6583e3aa8dbea56b851707070
MD5 1c7b3344cbac0249b94f7c92ef0c6657
SHA1 ce7d09dfbd8b5696079331263d9366813926991b
SHA512 5b84780c8be7b946ab737a75b291d82d62b93f2bf81b12f90483e3f7fa8ea9c0892e8e7d183f6d6230cad8717d350eda3cbb2a78587b9640c7ed56b551807e39
TLSH
T1BB11E3C1A931B973CCACC247C6953B529FE47523D4CA44143EE27D280DAF92E975B607
MD5 SHA1 SHA512 TLSH

Submit Download

211c6e52-e363-45ec-a2e5-d2519e2819dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\211c6e52-e363-45ec-a2e5-d2519e2819dd
Size 235B
SHA256 e4c8faafab3aa6dc8786ca74ccb98ecafdbfb17d236640874e994010c5839435
MD5 386c351258bdd0b5d34b0b35ef3153ec
SHA1 14cbc82a56d9cd51d10857ebf501fb58e6bb2ecd
SHA512 7223c1d86747d6f80eea2671ef1d9b2ad69e7f82e6d7b1b0dc2c92228a98a01ba69cec3f80dd8100130fd05a139b02f22b41b439f1b8ac09035e2954008d8cd2
TLSH
T1E0D0978028986B5C08144F07B0A0A8C634584C3314785C60CA6204B8CAF9AC40161817
MD5 SHA1 SHA512 TLSH

Submit Download

69402f6c-0dae-4b5c-a08d-42f610f56895

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\69402f6c-0dae-4b5c-a08d-42f610f56895
Size 2KB
SHA256 805ad3b8262f725ede63af471ade3ee24a464ce3b946095fb2ee1ff14e227e61
MD5 0ce6b58a9d66580d23112f74e595bc81
SHA1 06d9cb5434e22e9f0628872f77a00913665fa599
SHA512 32c652dc6fadfead2686e23aca88ad686c5040292b2a154807305f4c0ac72369551b08dec1a10ead52e5465c234ffb8af939feb06bab6ddba155af563b78be02
TLSH
T1FF41419C79789CB78CAAE14DE181238E53608E1300C619D32E91EE4CCC96A5D336F43B
MD5 SHA1 SHA512 TLSH

Submit Download

7282a0d7-fd28-47bd-a176-d7645fd1d58b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\7282a0d7-fd28-47bd-a176-d7645fd1d58b
Size 16KB
SHA256 0aae208f7753a8a5022ada8aa298c2eddd3aa2ec76b67b39de6d03bae6efd2ea
MD5 abee0d2243e98b8e60df174a9cf9ce65
SHA1 f62aec034759762f1dd4881107aac71ea2293a4b
SHA512 2e36ca534e2cc0ccdf57bda9e883417c39bdd82c6bda7a6767fba85ac3017ef4fdbaab2ea11831ec7370514cdae69a657fc32115e7766fbe0abfc8cceefd856b
SSDEEP 192:y1zjhDu9L7+EL1Yn7IBEke/yBdSi27zx0Mj7aGYD7EiCfaazFL4lBKKW887jevHq:Chu9L7PGEOP/yvSi27lPXrOgiC3+lW
TLSH
T17372D956682045BB8251E36994F8BFC3E6F638CF4C419FCADBE4BD0819DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89e1ca70-7e6c-4a29-9ded-cffba09ffc82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\89e1ca70-7e6c-4a29-9ded-cffba09ffc82
Size 886B
SHA256 d7d4e9c5f610d600e06d30ec28308c623cc4852297cd212744ca29a0bd90c853
MD5 3a610419b45c60edf4c19f31ede36f3d
SHA1 2fdabdd4054949e4cbae4df19f154dfc30b1be24
SHA512 725abc61db77727d92c143e8eb17f5cbf9c05d9536d13b07b8a0b7a9fbb708b7d00d3e882f153e0fa41ffd488e2907d4db2f9b494f717de566b7be50ed1a1f2b
TLSH
T1601140D29A32B9B28C3C8287C6D1BB934BE03023D0CA04143E95AA280DAA52D635A607
MD5 SHA1 SHA512 TLSH

Submit Download

fdfdfdb3-ad00-4971-84dd-0da9912296d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\fdfdfdb3-ad00-4971-84dd-0da9912296d7
Size 235B
SHA256 acb1a2f8c60860976bb36a9956393646e6642e53c6e7d37ecc8e98f038d320a2
MD5 094b94c1c1ab285c144c8e15682f1ebd
SHA1 8554329f79ec2f3ad6dbebacf9677aa6cfa1fb94
SHA512 3619444dcc3b8401264b59176972a1d45567e33fd488fe1e37cbb59540a93f333cf6e92e0434366cb8a736dbf36e31034bbd7df9e65ed84bea9808bcb94825e8
TLSH
T10FD097C12498B32E08240F03B0E03BC231844C332070A850E96440B49BBADC812A180F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
Size 6KB
SHA256 e80b286aed87c1c65afc0d5d18e3ef3afe7795f3becd8029d72e32331a0f4129
MD5 3c9da8020a4588199df72f20bf1250be
SHA1 6e45ca1d7dd3b3cc18594b7fb654c2ac91f4642c
SHA512 568d7bc3c47beae0189560528ddddd5262a1d6d2e90907abd4c9d4d7d20b4901aefb722c73bbcfda460423e4161ad4933aff475a870b348a5af9fbf2ec9b0ca9
SSDEEP 96:xHcUTUuqGqdf28cObzS5B3SSlDdv9jPnERH9O+y1Bw8On8L4cnrzhK:65Rdf28cfB3SS+9A1Bw8O+A
TLSH
T18FE13F7895188F7F64B6776CAC6888716AB2413BBBBF68C750B554C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 775becfab421f00caaed9649e358b6e768c711b80117be2024435c6ae5985808
MD5 8040bc1807e33c3b983e69fce00ab1a4
SHA1 eed170de1cc5fd4fcd6501881e5463d77ac018ea
SHA512 f3da3aa1f4738db3bd785b532bc6f1cad2ca8a76975bb6b3754669c88e3918e83ad81874db7f6f071d8e5d527aa8e88558749d5124962f40d89db107f7e56393
SSDEEP 96:xHcUTUuqGqdf2oE1zS5vWSSlDdv9jTnERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oE8vWSSS9A1Bw88+w
TLSH
T11DE1307894088BBF74B676ACAC6888716AB2413BB7BF68C750B554C5010CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
Size 6KB
SHA256 bb46d63c792daa074db074d09c150ad96bb11a6bdfd91d2aa29041eb695af07a
MD5 fbd0493d8174b04444ce1355f8035a18
SHA1 fb7b442e6885f7de3242e268cb7f24ec23b55228
SHA512 a6a26e03e97eb20ba10dc460030672432843259499ad43083872ac59b80abfcf004ff8d3a1c3358692325c5a4692c2ca8214971cd223e0b4aa54ef2eb0e6e4bf
SSDEEP 96:xHcUTUuqGqdf28c1zS5B3SSlDdv9jTnERH9O+y1Bw88n8L4cnrzBHK:65Rdf28c8B3SSS9A1Bw88+w
TLSH
T111E13F7894088F7F74B676ACAC6888716AB2413BB7BF68C750B554C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e
MD5 362985746d24dbb2b166089f30cd1bb7
SHA1 6520fc33381879a120165ede6a0f8aadf9013d3b
SHA512 0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61
TLSH
T10CD08C83C10950BACE826A58B398BB509E3E00F271140142B6AC888C183F023418B803
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2980-2-0x0000019DD6EA0000-0x0000019DD7110000-memory.dmp

Download

memory/2980-12-0x0000019DD6EA0000-0x0000019DD7110000-memory.dmp

Download

memory/2980-11-0x0000019DD56C0000-0x0000019DD56C1000-memory.dmp

Download